Hidden hoist picks a different version than pnpm when a package has two versions in the graph

[mwolson]

• aube: 2.8.1 linux-x64 (2026-10-20) (the loop in link_hidden_hoist_at is unchanged on main at 633f856)
• pnpm control: 12.14.0 and 11.10.0
• Repro: https://github.com/mwolson/tmp-aube-issues/tree/main/hidden-hoist-version-choice

When the graph has two versions of a package, aube and pnpm put different versions into the hidden hoist directory, even when aube installs from the lockfile pnpm wrote. An undeclared import from inside the virtual store then gets a different version under aube.

package.json:

{
  "name": "hidden-hoist-version-choice",
  "private": true,
  "dependencies": {
    "is-even": "1.0.0",
    "is-odd": "3.0.1"
  }
}

The graph has two is-number versions:

• is-odd@3.0.1 -> is-number@6.0.0 (depth 1)
• is-even@1.0.0 -> is-odd@0.1.2 -> is-number@3.0.0 (depth 2)

is-even doesn't declare is-number, so require("is-number") from inside is-even resolves through the hidden hoist.

PNPM_BIN=/path/to/real/pnpm ./repro.sh

pnpm 12.14.0: node_modules/.pnpm/node_modules has is-buffer is-number kind-of
pnpm 12.14.0: is-even resolves undeclared is-number to 6.0.0
aube 2.8.1 linux-x64 (2026-10-20): node_modules/.aube/node_modules has is-buffer is-even is-number is-odd kind-of
aube 2.8.1 linux-x64 (2026-10-20): is-even resolves undeclared is-number to 3.0.0
failed: aube hidden-hoists is-number@3.0.0 where pnpm hoists is-number@6.0.0

pnpm 11.10.0 gives the same result. aube gives the same result with CI unset (global virtual store) and when it resolves from scratch without a lockfile.

Why they differ

pnpm's hoistGraph sorts nodes by depth from the importers, breaks ties by node id, and gives each name to the first node it reaches. It also seeds the claimed set with the root importer's direct dependencies, so those are never hidden-hoisted. aube's link_hidden_hoist_at gives each name to the first entry in graph.packages order (the "first-writer-wins" comment), so the dep path that sorts first wins: is-number@3.0.0 sorts before is-number@6.0.0.

The same loop also hidden-hoists the root's direct dependencies. In this fixture, node_modules/.aube/node_modules/is-odd points to is-odd@0.1.2, so a store package that requires is-odd without declaring it gets 0.1.2 instead of the root's 3.0.1. Under pnpm it walks up to the root node_modules/is-odd (3.0.1).

Real-world impact

Found in pingdotgg/t3code (pnpm 12 lockfile, aube install --frozen-lockfile). vite is an alias of @voidzero-dev/vite-plus-core@1.3.0, which imports rolldown throughout its build code without declaring it. Its dist/ has 21 bare rolldown imports, plus rolldown/experimental (10), rolldown/utils (4), rolldown/filter (2), rolldown/api/experimental (2), and rolldown/experimental/runtime (1). The graph has rolldown@1.2.5 at depth 1 (under alchemy, a direct dependency of a workspace member) and rolldown@1.0.0-rc.17 at depth 2 (vite -> unrun). Resolving rolldown/package.json from vite-plus-core's dist/ gives 1.2.5 under pnpm 12.14.0 and 1.0.0-rc.17 under aube 2.8.1, so every Vite+ build in the aube-installed tree bundles with a different rolldown than the pnpm-installed one.

One test fails outright, because 1.0.0-rc.17 lacks a subpath export that 1.2.5 has:

Error: Package subpath './experimental/runtime' is not defined by "exports" in
.../node_modules/.aube/node_modules/rolldown/package.json imported from
.../node_modules/.aube/vite@1.3.0_.../node_modules/vite/dist/vite/node/chunks/node.js

The rest of the build runs on the older rolldown without an error, which is harder to notice. We moved that tree back to pnpm because of this.

The undeclared import is the package's own bug, but the hidden hoist exists to absorb exactly that, and projects moving from pnpm count on it picking the same version. I didn't find a rule for which version wins in the hoist / hoistPattern settings docs or on the node-modules page. Would aube consider matching pnpm's order (shallowest first, root direct dependencies excluded)?

[jdx]

Thanks for the thorough write-up and the t3code example. #1815 changes the hidden hoist to match pnpm's order: the shallowest version from the importers wins (ties go to the dep path that sorts first), and the root's direct dependencies are no longer hidden-hoisted. On your repro, is-number now hoists 6.0.0 and is-odd stays out of the hidden hoist.

Known gap: pnpm breaks same-depth ties by parent node id, aube by the package's own dep path, so two versions at the same depth can still differ. I checked against the pnpm output in your report, not a real pnpm binary.

AI-assisted — Tool: Claude Code; model: anthropic/claude-sonnet-5-5; version: unavailable.

[github-actions[bot]]

Implemented in #1815: fix(linker): hidden-hoist shallowest version first like pnpm

[mwolson]

Retested with aube 2.8.2 linux-x64 (2026-10-23):

• Repo: https://github.com/mwolson/tmp-aube-issues
• Case: hidden-hoist-version-choice

PNPM_BIN=/path/to/real/pnpm ./repro.sh

It now exits 0 with native pnpm 12.14.0 as the control. is-even resolves its undeclared is-number to 6.0.0 under both. In pingdotgg/t3code, a frozen aube 2.8.2 install now hidden-hoists rolldown@1.2.5, matching pnpm, and the bundled-dev test that failed under 2.8.1 passes.

Fix shipped in aube 2.8.2 via #1815. Marking your reply as the answer.